SEC Proposes Changes to Adviser Custody Rules, Including New Cryptoasset Custody Framework 

Introduction

On October 1, 2026, the Securities and Exchange Commission (the Commission or SEC) proposed a broad set of changes to the custody framework governing investment advisers (the Proposal).Adviser and Regulated Fund Custody Rules; Crypto Custody Rules, Release Nos. IA-7023; IC-36353 (Oct. 1, 2026). These changes, which would impact the rules under the Investment Advisers Act of 1940, as amended (the Advisers Act), are intended to modernize custody regulations to account for cryptoassets,For purposes of the Proposal, a cryptoasset is any digital representation of value that is recorded on a cryptographically secured distributed ledger. market changes and practices, and industry feedback. While many of the changes simply reflect a codification of SEC staff guidance, the Proposal includes significant changes with respect to the custody of certain cryptoassets as well as new requirements and exceptions.

In this Alert, we discuss proposed changes to enable investment advisers to self-custody cryptoassets, allow advisers to maintain assets with State-chartered limited purpose trust companies (State trust companies) subject to specified conditions, and update the Advisers Act custody framework to address, among other areas, authorized trading, permitted auditors, audited financial statement requirements, and inadvertent custody.This Alert does not cover amendments governing investment companies registered under the Investment Company Act of 1940 or proposed rule amendments thereunder.

Overview of Proposal

Self-Custody of Cryptoassets

Proposed Conditions for Investment Advisers to Self-Custody Cryptoassets

The Proposal would make changes to permit investment advisers, under certain circumstances, to self-custody cryptoassets. These proposed changes are a response to the evolution of cryptoasset markets and questions about the pool of custodians that are able or willing to provide custodial services in connection with investment advisory activities in this space. Under the Proposal, “self-custody” means the adviser holding a client’s cryptoasset through possession of any portion of the private keys that is necessary to access and effectuate transactions in the cryptoasset without maintaining the cryptoasset at a permitted custodian. In recognition of the inherent conflicts of interest and risks associated with self-custody, the Commission proposed the following conditions, which, if complied with, would allow an investment adviser to self-custody cryptoassets:

• Qualified custodian determination: The adviser must determine in writing, as an initial matter and on a quarterly basis, that a permitted custodian is not available to maintain the cryptoasset.
• Safeguarding expertise and systems: The adviser must have expertise in safeguarding each cryptoasset (and document the basis of its determination that it has such safeguarding expertise). The adviser must further adopt, implement, and maintain systems to safeguard each cryptoasset against loss, theft, misuse, and misappropriation, and must review its safeguarding systems and the effectiveness of their implementation on an annual basis.The Commission further explained that the adviser’s safeguarding systems would be required to address private key management and joint authorization of any cryptoasset transactions by at least two people, and to maintain each client’s cryptoassets in one or more addresses, corresponding only to such client’s cryptoassets on the crypto network.
• Cybersecurity: The adviser would be required to mitigate cybersecurity risks associated with safeguarding clients’ cryptoassets that are held in self-custody and review its cybersecurity controls and the effectiveness of their implementation no less than annually.
• Internal control reports: The adviser would be required to obtain internal control reports concerning its safeguarding of cryptoassets within six months of maintaining custody of cryptoassets and on an annual basis thereafter.
• Self-custody account statements: The adviser would be required to send account statements at least quarterly to each client whose cryptoassets the adviser self-custodies, identifying the cryptoasset address on the crypto network that stores the client’s cryptoassets and the crypto network on which such cryptoasset address operates, the amounts of cryptoassets stored in the client’s cryptoasset address at the end of the period, and setting forth all transactions from that cryptoasset address during that period. The adviser would also be required to include a statement urging the client to compare the account statements from the adviser with the cryptoasset balances and transaction information indicated under the client’s cryptoasset address, which is similar to the existing requirement for account statements under the Custody Rule.The Commission explained that advisers may satisfy this requirement if, in lieu of an account statement, they transmit, or arrange for the transmission, to clients of the information required to be provided in the account statement in a human-readable and reasonably usable electronic format, provided that a notice is sent to the client identifying the cryptoasset address that stores the client’s cryptoassets and the crypto network on which such cryptoasset address operates.

• Financial asset election: The adviser and the client must agree in writing to treat each cryptoasset that is in the adviser’s self-custody as a financial asset, and that the adviser holding the client’s cryptoasset in self-custody is a securities intermediary, pursuant to applicable State law governing the written agreement between the adviser and the client.The Proposal notes that State law governs the written contractual treatment of an asset as a financial asset and a party to the written agreement as a securities intermediary pursuant to the applicable State’s enacted version of Article 8 of the Uniform Commercial Code.
• Recordkeeping: Advisers would also be required to comply with certain recordkeeping requirements.

Proposed Conditions for State Trust Companies to Have Custody of Cryptoassets

Investment advisers with custody of client funds or securities must comply with the Custody Rule under the Advisers Act, which requires that such funds or securities be maintained with a qualified custodian, subject to certain exceptions. For purposes of the Custody Rule, a qualified custodian generally includes banks, broker-dealers, futures commission merchants, and foreign financial institutions meeting certain conditions. As cryptoasset markets have evolved, State trust companies have emerged to provide custodial services. To provide more regulatory clarity around their ability to meet the definition of qualified custodian, the Commission recently provided staff guidance for purposes of the Advisers Act. The Proposal would offer further clarity under the Advisers Act to permit State trust companies to have custody of client cryptoassets, provided that an investment adviser meets the following proposed conditions:

• State regulation: Prior to engaging a State trust company as a permitted custodian and annually thereafter, the adviser must have a reasonable basis, after due inquiry, for believing that the State trust company is authorized by the relevant State banking authority to provide cryptoasset custody.
• Policies and procedures: Prior to engaging a State trust company as a permitted custodian and annually thereafter, the adviser must have a reasonable basis, after due inquiry, for believing that the State trust company maintains and implements written policies and procedures that are reasonably designed to safeguard cryptoassets and related cash and/or cash equivalents from the risk of theft, loss, misuse, and misappropriation.
• Audited financial statements: The adviser would be required to receive and review the State trust company’s most recent annual audited financial statements as an initial matter and on an annual basis thereafter.
• Internal control reports: The adviser would be required to receive and review the State trust company’s most recent internal control report as an initial matter and on an annual basis thereafter.
• Segregation of assets: All advisory client cryptoassets would be required to be segregated from the State trust company’s proprietary assets.
• Recordkeeping: Advisers would also be required to comply with certain recordkeeping requirements.

Custody Rule Modernization under the Advisers Act

The Proposal would address a number of areas under the Custody Rule, largely in response to industry feedback around how it applies to evolving industry and market practices. It would also codify SEC staff guidance in several areas.

Redesignation of the Custody Rule to Rule 223-1

The Proposal would redesignate the Custody Rule as new Rule 223-1 under the Advisers Act. In the Dodd-Frank Wall Street Reform and Consumer Protection Act (the Dodd-Frank Act), Congress expressly vested the Commission with authority to promulgate rules requiring registered advisers to take steps to safeguard client assets over which advisers have custody by adding Section 223 to the Advisers Act.The legislative history around the Dodd-Frank Act indicates that Congress heard testimony that certain client investments were not covered by the custody rule because they were neither funds nor securities, putting them at greater risk. In the Proposal, the SEC noted that this redesignation would better align the new rule with specific statutory authority granted as part of the Dodd-Frank Act.

Exception for Discretionary Trading Authority

The Proposal would provide a specific exception for discretionary trading authority by an adviser from the Custody Rule, provided that the adviser:

• executes (and only has authority to execute) such trades only from and into designated client accounts in the client’s name or the transfer is recorded in the client’s name by the issuer;
• has no authority (under the discretionary trading arrangement or otherwise) to transfer client funds or securities from the designated client account to itself or an account the adviser or its related person controls, or to any account that is not the client’s unless such transfer is directed by the client in connection with such trading, nor does the adviser have the authority to have the transfer recorded by the issuer in its own name or that of a related person; and
• complies with Rule 223-1 for any other activities, rights, or authorities that otherwise cause it to have custody of such funds or securities separate from such discretionary trading authority and with the requirements of any corresponding exceptions under Rule 223-1 that the adviser may exercise pursuant to such custody.

The Proposal notes that an adviser that is seeking to rely on this discretionary trading authority exception should adopt written policies and procedures that are reasonably designed to ensure that the adviser’s discretionary trading practices meet the conditions set forth above.

This proposed discretionary trading authority exception stems from interpretive ambiguity around language in the adopting release for the 2003 amendments to the Custody Rule, which added an authorized trading exception to the Custody Rule.See Custody of Funds or Securities of Clients by Investment Advisers, Release No. IA-2176 (Sept. 25, 2003). Although not set forth in the Custody Rule itself, the adopting release for the 2003 amendments provided that:

An adviser’s authority to issue instructions to a broker-dealer or a custodian to effect or to settle trades does not constitute “custody.” Clients’ custodians are generally under instructions to transfer funds (or securities) out of a client’s account only upon corresponding transfer of securities (or funds) into the account. This “delivery versus payment” arrangement minimizes the risk that an adviser could withdraw or misappropriate the funds or securities in its client’s custodial account.

Based on subsequent guidance from the SEC, questions arose in the industry as to whether a “delivery versus payment” arrangement, specifically cited in the language above, is necessary to meet the authorized trading exception.See Inadvertent Custody: Advisory Contract Versus Custodial Contract Authority, Division of Investment Management Guidance Update No. 2017-01 (Feb. 2017) (2017 Inadvertent Custody IMGU). Industry concern centered around the difficulty that certain instruments, such as loans and derivatives, would have in meeting an authorized trading exception that requires “delivery versus payment.” The Proposal seeks to address these concerns by both addressing custody risk and distinguishing settlement risk around trading (which the SEC notes that the Custody Rule is not designed to address). The Proposal makes clear that a “delivery versus payment” arrangement is not required to rely on the proposed discretionary trading exemption.

PCAOB-Registered Accountant Requirement

The Proposal would remove the requirements that accountants performing a required audit or surprise examination (where an internal control report is needed due to self-custody) must be registered with, and subject to regular inspection by, the PCAOB.Under the Custody Rule audit provision, a pooled investment vehicle’s annual audited financial statements must be prepared by a PCAOB-registered and -inspected independent public accountant for the adviser to such vehicle to be deemed to satisfy the surprise examination requirement and be excepted from the client notice and account statement delivery requirements. Additionally, if an adviser or a related person of the adviser maintains client funds or securities as a qualified custodian, an independent public accountant that is registered with, and subject to regular inspection by, the PCAOB must perform the required surprise examination and prepare the required internal control report. Under the current Custody Rule audit exception, a pooled investment vehicle’s annual audited financial statements must be prepared by a PCAOB-registered and -inspected independent public accountant. Additionally, if an adviser or a related person of the adviser maintains client funds or securities as a qualified custodian, an independent public accountant that is registered with, and subject to regular inspection by, the PCAOB must perform the required surprise examination and prepare the required internal control report.

Drawing on 17 years of experience, the Commission noted that PCAOB registration requirements may not justify the incremental cost of an adviser engaging a PCAOB-registered firm. The Commission further noted that because the PCAOB does not currently examine or inspect accountants with respect to the services required under the Custody Rule, the PCAOB registration and inspection requirements are not an appropriate proxy for the quality of the required audit and examination services. If adopted, the Proposal would increase the number of accountants available to perform required audit or examination services and help advisers avoid foot-faults with respect to their selection of auditors (which has been a focus of the SEC staff in recent years).

Audit Provision

The Proposal would make several changes to the audit exception under the Custody Rule, including the codification of several SEC staff positions.

Audit and Delivery Requirement for Newly Formed Pooled Investment Vehicles

The Proposal would provide flexibility from the current audit requirements for new pooled investment vehicles that are formed within the last 90 days of their fiscal year (New Fund). Under the Proposal, advisers would not be required to deliver audited financials within 120 days of a New Fund’s fiscal year-end, provided that:

• financial statements (which may be unaudited) covering the last 90 days of the first fiscal year are distributed to investors within 90 days of the end of the first fiscal year; and
• audited financial statements are distributed to investors that cover the first fiscal year (i.e., the last 90 days of the first fiscal year, if previously unaudited) and the entire second fiscal year after the end of the second fiscal year.

Use of US GAAP and Reconciliation to US GAAP for Foreign Pooled Investment Vehicles

The Proposal would codify current SEC staff guidance that provides greater flexibility under the audit exception (which effectively requires that audited financial statements be prepared in accordance with US GAAPWhile the Custody Rule does not explicitly require that financial statements be prepared in accordance with US GAAP specifically, it has been the SEC’s longstanding view that, except in the limited circumstances noted in existing SEC staff guidance, audited financial statements need to be prepared in accordance with US GAAP.) for pooled investment vehicles organized under non-US law or that have a general partner or other manager with a principal place of business outside the United States (foreign PIVs) that meet certain conditions.

Specifically, the Proposal would allow for financial statements of foreign PIVs to be prepared in accordance with accounting principles other than US GAAP, provided that the financial statements contain information substantially similar to the information contained in financial statements prepared in accordance with US GAAP, including a reconciliation to US GAAP for material differences, and such reconciliation is delivered to the pooled investment vehicle’s US investors, along with the required audited financial statements. This approach would effectively codify existing guidance from the SEC staff that allows for the use of different accounting standards.See SEC, Staff Responses to Questions About the Custody Rule (last updated Feb. 21, 2017), available at https://www.sec.gov/rules-regulations/staff-guidance/division-investment-management-frequently-asked-questions/staff-responses-questions-about-custody-rule, Question VI.5.

Distribution of Audited Financial Statements

Fund of Funds Structures.

The Proposal would effectively codify existing SEC staff guidance by extending the current 120-day delivery deadline for annual audited financial statements to 180 days for funds of funds and 260 days for funds of funds of funds.

Independent Representatives.

The Proposal would amend the audit provision’s delivery requirement to provide that the audited financial statements may be delivered to an independent representative of an investor. This modification would be consistent with the approach under the Custody Rule for client notices and account statements (for advisers using the surprise examination requirement).

Unforeseeable Circumstances

While not addressed in the rule text, the Proposal provides that in the Commission’s view, an adviser’s failure to distribute audited financial statements within the applicable timelines generally would not be considered a violation, provided that the adviser reasonably believed that the pooled investment vehicle’s audited financial statements would be distributed within 120 days of fiscal year-end (or the proposed 180-day or 260-day deadlines from fiscal year-end for funds of funds or funds of funds of funds, as applicable) but failed to have them distributed in time due to reasonably unforeseeable circumstances.

The adviser would be responsible for ensuring that the pooled investment vehicle’s audited financial statements are promptly delivered upon resolution of the reasonably unforeseeable circumstances. The Proposal highlighted unexpected technology issues or a force majeure event as examples of such circumstances. This position is consistent with current SEC staff guidance. The Proposal is seeking comment on whether the Commission should provide guidance on the circumstances under which failure to timely distribute audited financial statements is reasonably unforeseeable.

The SLOA Exception: Proposed Conditions

The Proposal would include an exception from the independent verification requirement for client funds and securities if the adviser has custody of those funds and securities solely because of an arrangement between the adviser, the client, and the client’s qualified custodian in which the adviser is authorized, in writing, to direct the qualified custodian to transfer funds and securities to a third-party recipient on a specified schedule or from time to time (a SLOA) subject to the following conditions:

• The client’s qualified custodian is not the adviser or its related person;
• The client’s authorization includes the client’s signature, the third-party recipient’s name, and either the third-party recipient’s address or account number at a custodian to which the transfer should be directed; and
• The adviser has no ability or authority to designate or change any information about the third-party recipient, including name, address, and account number.

Under the SLOA exception, although an adviser would not need to comply with the independent verification requirement, the adviser would continue to have custody over client funds and securities. This exception follows a similar position taken by the SEC staff in a 2017 no-action letter.See Investment Adviser Association, SEC Staff No-Action Letter (Feb. 21, 2017).

Account Number in Notice to Clients

The Proposal would require a client’s account number to be included in the notice sent by an adviser upon opening an account with a qualified custodian on behalf of such client. The account number addition is intended to help investors better monitor where their assets are held, and expands upon the current requirement that the adviser provide the custodian’s name, address, and a description of the manner in which the funds or securities are maintained.

Treatment of Business Development Companies

Currently, the Custody Rule provides an exception from its requirements for 1940 Act-registered investment companies. Except with respect to BDCs for which an adviser has self-custody, the Proposal would extend this exception to BDCs, which would be defined to mean an entity that has elected to be regulated or regulated as a BDC pursuant to Section 54 of the 1940 Act and has not withdrawn the election.

Electronic Notice to the Commission of Material Discrepancies

The Proposal would amend the notice an accountant must provide upon the finding of any material discrepancies during the course of an independent verification to state that the accountant must send the notice by electronic means to the Division of Examinations. This change is intended to modernize the current rule, which requires that the notice be sent by means of a facsimile transmission or electronic mail, followed by first-class mail to the Director of the Office of Compliance Inspections and Examinations (which has since been renamed the Division of Examinations).

Inadvertent Custody

The Proposal would provide an exception with respect to funds and securities over which an adviser has custody arising solely from custodial agreements that the adviser has no knowledge or reason to know confers custody upon it provided that the adviser did not recommend the qualified custodian. This proposed exception relates to the concept of “inadvertent custody,” articulated by the SEC staff in 2017, which arises when an adviser inadvertently receives authority (generally through broadly drafted custodial agreements) to obtain possession of client funds or securities or the ability to withdraw them upon instruction to the custodian — thereby imputing the adviser with custody under the Custody Rule.See IM Guidance Update, Inadvertent Custody: Advisory Contract Versus Custodial Contract Authority, No. 2017-01 (Feb. 2017). In proposing this exception, the Commission explained that the risk of misappropriation of client funds or securities can be substantially mitigated if an adviser meets certain conditions and takes steps upon the discovery of inadvertent custody. Specifically, this exception would apply where:

• the adviser did not recommend, request, or require that the client select the qualified custodian maintaining such funds and securities; and
• either (a) the adviser does not have a copy of the client’s custodial agreement, nor actual knowledge or reason to know that any custodial agreement between the client and such qualified custodian confers custody upon the adviser; or (b) if the adviser knows or has reason to know that a custodial agreement confers custody on the adviser, the adviser promptly notifies the client and qualified custodian in writing of such unwanted authority, and repudiates such authority to the client and qualified custodian and requests in writing that such authority be removed from the custodial agreement or be superseded by a new agreement, consented to by both the client and the qualified custodian, that does not confer custody on the adviser.

The Commission further explained that advisers seeking to rely on this exception should have reasonably designed policies and procedures in place required by Rule 206(4)-7 to address circumstances in which they (1) become aware that they have custody inadvertently from a custodial agreement and (2) provide for: reviewing client custodial agreements to which they have access or knowledge of possessing unwanted authority; disavowing unwanted authority; and requesting amendments to agreements as applicable.

Form ADV Amendments

The Proposal includes several amendments to Form ADV, including conforming amendments to reflect the proposed changes. The Proposal includes amendments to: (1) Part 1A Item 9 to add several new questions related to advisers’ cryptoasset self-custody practices; and (2) Part 1A Item 5.K. and Section 7.B. of Schedule D to add questions about cryptoassets that are self-custodied on behalf of separately managed account clients and private funds. The Proposal also notes that additional disclosures regarding the material risks and potential conflicts of interest related to investing in cryptoassets and holding cryptoassets may need to be made pursuant to Items 4 and 8 of Form ADV Part 2A beyond what is prescribed in the instructions and in order to comport with an adviser’s fiduciary duty. The Commission requested comment on whether advisers should be required to report any additional information regarding their tokenization practices, including, for example, whether advisers should be required to report tokenization of client assets on behalf of any advisory client, not just private funds, as proposed, and if they should be required to report, what additional information should be reported.